One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked on IoT devices.
The commands I used for both tools are as follows:
Medusa -h "IP address" -u "default login" -P Desktop/rockyou.txt -n 80 -M http Hydra -l "default login" -P Desktop/rockyou.txt -e ns -f -V "Ip address" http-get
Hydra did seem to work fine on other devices and would attempt to go through the entire list. But for this TP-Link Netcam it seemed that both tools would just go partially through the lists and sometimes give multiple false positives within the few attempts made.
While I do not have access to these devices anymore to continue testing, I would at least like to know if it was something I entered wrong? Or if the device has something that could potentially stop this?